NetBIOS Datagram
What is Port 138?
Port 138 is used by the NetBIOS Datagram Service, which provides connectionless communication between NetBIOS applications. This service handles browse announcements, domain logon requests, and NetBIOS name resolution broadcasts. In Windows networking, the Computer Browser service uses port 138 to maintain the browse list — the list of computers visible in Network Neighborhood. When a Windows PC starts up, it announces its presence via broadcast datagrams on port 138. The master browser collects these announcements and compiles the browse list that other computers can request. While modern Windows networks rely more on DNS and Active Directory for service discovery, port 138 remains active on many networks for backward compatibility.
Common Uses
- Windows network browser service announcements
- Domain logon and authentication broadcasts
- NetBIOS datagram distribution
- Legacy Windows workgroup communication
Technical Details
Copy-paste commands to check port 138 (NetBIOS Datagram) from your terminal
Test connectivity
nmap -p 138 -sU -sV example.com
(echo > /dev/tcp/example.com/138) 2>/dev/null && echo "open" || echo "closed"
Open port in firewall
sudo ufw allow 138/udp
sudo iptables -A INPUT -p udp --dport 138 -j ACCEPT
sudo firewall-cmd --permanent --add-port=138/udp && sudo firewall-cmd --reload
Security Considerations
Port 138 datagrams can be exploited for information disclosure, revealing computer names, domain membership, and user information. It can also be used in relay attacks. Block this port at all network boundaries. Disable the Computer Browser service and NetBIOS over TCP/IP on systems that don't need it.
Popular Ports Reference
The most commonly used and referenced network ports